Onamae Desktop Cloud breach: known flaws and trading sessions

Onamae.com Desktop Cloud is the Windows virtual server service run by GMO Internet (part of GMO Internet Group, one of Japan’s largest domain registrars), marketed as an ideal environment for automated foreign exchange trading with MetaTrader 4. Since 20 October the service has been at the centre of a serious incident: an attacker installed malicious programs in customer environments, stole data and demanded a ransom. According to GMO, 26,739 servers may be affected.

The four sources (two BleepingComputer articles, The Register and The Hacker News) track the company’s successive notices. The most relevant technical point is an admission: the vulnerabilities that were exploited had already been reported inside GMO.

Timeline

• 20 October: GMO confirms unauthorised access and the installation of “malicious programs” in some customer server environments (BleepingComputer).
• 21 October, 04:00 local time: customer servers are progressively shut down. All plans are affected, with no restart date. Payment data, stored on separate infrastructure, is reportedly not involved.
• Following days: some customers report unauthorised operations on their trading accounts. GMO says third parties have probably seen trading service passwords and admits that customer data has been taken out of the company (The Register).
• Ransom demand: ¥8 billion, about $50 million. GMO refuses to pay, because paying would not guarantee that the data is deleted.
• 26 October: GMO warns that the attacker is threatening to leak data and to trigger a ransomware payload planted earlier on customer servers (BleepingComputer).
• 27 October: GMO asks customers to make a backup and then, before noon, disconnect their PCs from the network, shut them down and unplug all cables. It is working with Trend Micro on the clean-up and confirms that company and customer data has been published. According to BleepingComputer, the ransomware does not appear to have been activated.
• 28 October: The Hacker News reports a $1 million bounty offered by GMO to identify those responsible. Only the headline of that article was available, so this comes from a single source.

What is known technically

The sources give no CVE, initial access vector, malware family or indicators of compromise. What is known:

• in a blog post quoted by The Register, CEO Masatoshi Kumagai writes that the service’s systems had vulnerabilities already flagged by the group’s in-house white-hat hackers. Countermeasures were under way, but the response, slowed by concern for service availability and by other priorities, “lacked sufficient depth and speed”;
• according to BleepingComputer, the exposed information includes MetaTrader 4 and 5 credentials and trading account details;
• GMO warns that some trading apps keep sessions alive even after a password change. It has therefore asked major trading services to forcibly terminate active sessions, monitor for unauthorised transactions and block orders coming from Onamae Desktop Cloud (The Register);
• passwords should be changed from a device other than the one used for trading. According to The Register, GMO also considers users’ personal devices at risk, but the sources do not explain how malware could reach them from the virtual servers.

Kumagai also mentions ARTEX, an autonomous AI-based penetration testing tool. According to the group’s security unit, its misuse was the source of attacks against about 20 Japanese companies. In the text quoted by The Register, however, ARTEX is not named as the cause of this breach.

For threat hunting, the known facts concern the use of valid credentials on accounts (MITRE ATT&CK T1078 Valid Accounts) and a ransomware threat that was not carried out (T1486 Data Encrypted for Impact). The sources are not enough for a more precise attack chain.

Why it matters for European companies

The case shows two problems that apply well beyond trading. First, a provider of hosted virtual servers or desktops concentrates risk: compromising its infrastructure reaches thousands of customers and every session opened from their environments. Second, changing the password is not enough if sessions stay valid.

For NIS2 entities, supply chain security is one of the measures in Article 21. For financial entities, DORA requires management of ICT third-party risk, including exit plans for critical providers. GMO’s admission also concerns vulnerability management: findings from internal testing need firm deadlines, not postponement for fear of disruption.

What to do now

If you or your staff use Onamae Desktop Cloud:

• change the passwords of trading accounts and other services used from the virtual servers, from a clean device;
• terminate all active sessions from your broker’s dashboard or ask its support desk to do it, then review recent operations and logins;
• treat the PCs used to connect as at risk until GMO completes its analysis: offline backup, full scan and no connection to the corporate network until verified;
• be wary of emails and calls that use the incident as a pretext: GMO says it never asks for passwords or card details.

In general:

• include session and token revocation in your incident response procedures, not just password changes, and check which critical applications support it;
• for the most sensitive accounts, use multi-factor authentication and, where the service offers it, an allowlist of IP addresses;
• on hosted desktops, limit clipboard, drive and printer sharing with the local PC to what is strictly necessary;
• set deadlines for findings from internal penetration tests and track their closure;
• ask virtual desktop and server providers for incident notification times and a tested exit procedure.

How ARXDOME helps

ARX Shield shows open vulnerabilities on monitored machines and lets you isolate a suspicious PC from the network pending analysis. ARX Expose flags company accounts that appear in data breaches, useful if the published information includes your users’ credentials. ARX Sentry collects logs and events from computers, servers and firewalls, so anomalous access stands out quickly.

Last updated: 28 October 2026